Skip to main content

ws (Node.js WebSocket) CVE-2026-48779

HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-15 https://github.com/websockets/ws GHSA-96hv-2xvq-fx4p
Denial Of Service
7.5
CVSS 3.1 · Vendor: https://github.com/websockets/ws
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify Node.js service using ws
  2. Delivery
    Open WebSocket connection
  3. Exploit
    Send stream of 1-byte fin:false fragments
  4. Install
    Server allocates structural wrappers per fragment
  5. C2
    V8 heap exhausted past maxPayload guard
  6. Execute
    Node process OOM-killed
  7. Impact
    Service availability lost

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires only that the target expose a 'ws'-based WebSocket endpoint reachable from the attacker over TCP, with default or any maxPayload configuration that does not also cap fragment count or per-connection heap growth - the flaw is independent of message-byte limits because the structural wrappers, not the payload bytes, drive memory growth. No authentication, user interaction, or non-default configuration is required (CVSS PR:N/UI:N), and the attacker controls the client side of an ordinary WebSocket handshake. Limiting factors: the service must actually accept WebSocket upgrades from the attacker's network position, and front-end proxies or WAFs that enforce per-connection frame-rate, idle-timeout, or memory-quota limits can blunt the attack; services running ws 5.2.5 / 6.2.4 / 7.5.11 / 8.21.0 or later are not affected.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a network-reachable, unauthenticated, low-complexity availability attack with no impact on confidentiality or integrity - a textbook DoS. KEV does not list this CVE and EPSS is not provided, so there is no evidence of mass in-the-wild exploitation; however, publicly available exploit code exists (embedded in the GHSA advisory) and the attack requires only commodity tooling, which raises practical risk for any Internet-exposed Node.js service that terminates WebSocket connections directly with ws. The realistic priority is high for public-facing WebSocket endpoints (chat, collaboration, trading, IoT gateways, dev tooling exposed to LAN) and moderate for internal-only services, since a single misbehaving client can take down a process. No conflicting signals were observed between description and CVSS.
Exploit ScenarioDerived

An attacker opens a single WebSocket connection to a vulnerable Node.js service and, using the publicly available PoC from GHSA-96hv-2xvq-fx4p, transmits an unbounded stream of 1-byte fragments with fin:false. The server allocates a structural wrapper per fragment, the V8 heap grows past its limit, and the Node process is killed by the OOM killer or its own heap-size guard, taking down all other tenants of that process.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Memory exhaustion denial of service in the npm 'ws' WebSocket library allows a remote unauthenticated peer to crash a Node.js process by streaming many tiny WebSocket fragments that force the receiver to allocate structural wrappers far exceeding the documented maxPayload limit, ultimately triggering an out-of-memory termination. The flaw affects ws versions prior to 5.2.5, 6.2.4, 7.5.11, and 8.21.0, and publicly available exploit code exists in the GitHub Security Advisory GHSA-96hv-2xvq-fx4p.

RemediationAI

Vendor-released patch: upgrade to ws 8.21.0 on the 8.x line, or apply the backports ws 7.5.11, 6.2.4, or 5.2.5 depending on the branch in use (commits bca91ad, fd36cd8, 86d3e8a, and b5372ac respectively, all referenced from https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p). After upgrading the direct dependency, run npm ls ws or equivalent to identify transitive copies pulled in by frameworks and either bump the parent package or use npm overrides / yarn resolutions to force the fixed version. If patching cannot be done immediately, the vendor-documented workaround is to lower the maxPayload option on the WebSocketServer / WebSocket constructor - the side effect is that legitimate clients sending larger messages will be disconnected, so the value should be set just above your application's real maximum frame size. Additional compensating controls include placing the WebSocket endpoint behind a reverse proxy or load balancer that enforces per-connection frame-rate and idle-time limits, and constraining process memory via systemd MemoryMax / Kubernetes memory limits so an OOM affects only one replica.

Affected Packages

npm ws fix: 5.2.5, 6.2.4, 7.5.11, 8.21.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The 'ws' package is one of the most widely deployed pure-JavaScript WebSocket client and server implementations on Node.js, used directly and transitively by countless web frameworks (Socket.IO, Next.js dev server, Playwright, Webpack DevServer, etc.). The CPE strings (pkg:npm/ws) confirm the npm distribution is affected across major branches 5.x, 6.x, 7.x, and 8.x. The root cause is CWE-400 (Uncontrolled Resource Consumption): when a peer sends a flood of unfinished frames (fin:false) carrying very small payloads, the receiver creates a structural wrapper object per fragment whose bookkeeping overhead is several orders of magnitude larger than the byte payload itself. Because the existing maxPayload guard accounts for declared message bytes rather than the JavaScript object graph holding fragment metadata, an attacker can stay well under the documented byte limit while pushing the V8 heap toward OOM.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/websockets/ws) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote, unauthenticated peer over a standard WebSocket connection with no user interaction; impact is availability-only (process OOM), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (https://github.com/websockets/ws).

CVSS VectorVendor: https://github.com/websockets/ws

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept

js
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

Patches

The vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws@5.2.5 (https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 320 npm packages depend on ws (27 direct, 295 indirect)

Ecosystem-wide dependent count for version 1.1.0.

Executive ViewAI

Why It Matters

The npm 'ws' WebSocket library contains a remotely exploitable memory exhaustion vulnerability affecting Node.js applications across versions prior to 5.2.5, 6.2.4, 7.5.11, and 8.21.0. Unauthenticated attackers can crash these applications using publicly available exploit code, creating immediate denial-of-service risk to any web service relying on this widely deployed library. Organizations should prioritize patching to maintain operational stability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 55% exploitable
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment GHSA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

pkg:npm/ws
pkg:npm/ws
pkg:npm/ws
pkg:npm/ws

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
PATCH https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7 PATCH https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53 PATCH https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94 PATCH https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 ADVISORY https://access.redhat.com/errata/RHSA-2026:29197 ADVISORY https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p ADVISORY https://vuldb.com/vuln/371540 REF https://access.redhat.com/errata/RHSA-2026:26638 REF https://access.redhat.com/errata/RHSA-2026:27171 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34342 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:37272 REF https://access.redhat.com/errata/RHSA-2026:40984 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41941 REF https://access.redhat.com/errata/RHSA-2026:41944 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:56366 REF https://access.redhat.com/errata/RHSA-2026:56431 REF https://access.redhat.com/errata/RHSA-2026:57013 REF https://access.redhat.com/errata/RHSA-2026:57590 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-48779 REF https://bugzilla.redhat.com/show_bug.cgi?id=2489661 REF https://github.com/advisories/GHSA-96hv-2xvq-fx4p REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy